genRandomString support stdencoding/urlencoding

add user permission check